Personal Data Processing Policy

1. General provisions

1.1. This Policy is prepared in accordance with the Constitution of the Russian Federation, Federal Law No. 152-FZ of 27 July 2006 “On Personal Data”, Russian Government Decree No. 1119 of 1 November 2012, and other applicable regulations.

1.2. The purpose of the Policy is to protect the rights and freedoms of individuals when their personal data is processed, and to respect the rights of data subjects in the Operator’s activities.

1.3. This Policy applies to all information the Operator may receive from data subjects when they use the website, when contracts are performed, and in dealings with clients and users.

1.4. The Policy is published at https://v2.sintaxis.ru/privacy and may also be provided on a written request from a data subject to legal@sintaxis.ru.

2. Terms and definitions

Operator

— Sintaxis LLC, which processes personal data.

Personal data

— any information relating to a directly or indirectly identified natural person (the data subject).

Processing of personal data

— any action or set of actions performed on personal data, with or without automation (collection, recording, organization, accumulation, storage, updating, use, transfer, de-identification, blocking, deletion, and destruction).

Personal data information system

— an information system that contains databases of personal data.

Automated processing

— processing carried out with computing equipment.

Blocking

— a temporary stop to the processing of personal data (except where processing is needed to clarify that data).

Destruction

— actions that make it impossible to restore personal data, and/or actions that destroy the physical media that hold it.

De-identification

— actions after which personal data can no longer be attributed to a specific subject without additional information.

3. Purposes of processing

The Operator processes personal data only for the following purposes:

promoting goods, work, and services using means of communication;
entering into, performing, and ending civil-law contracts;
meeting the requirements of the laws of the Russian Federation;
responding to website users, including requests, proposals, and inquiries;
protecting the rights and legitimate interests of the Operator and of data subjects.

4. Categories of personal data

4.1. General personal data:

last name, first name, and patronymic;
date and place of birth;
registered and residential address;
contact details (phone, email);
passport details, taxpayer ID (INN), and insurance number (SNILS);
information about professional activity and education, photographs, video, and audio recordings.

4.2. Special categories:

nationality;
health information;
information about a criminal record — only with the subject’s written consent.

4.3. Biometric data:

a facial image and a voice that can be used to identify the subject — only with written consent.

5. Data subjects

The Operator processes personal data of the following categories of subjects:

Clients (including prospective clients);
Website users and visitors to the Operator’s online resources;
Counterparties and their representatives;
Beneficiaries and guarantors under contracts.

6. Legal grounds for processing

Consent of the data subject;
The need to enter into or perform a contract to which the data subject is a party;
Compliance with the laws of the Russian Federation;
Exercise of the Operator’s rights and legitimate interests, provided the rights and freedoms of the data subject are not infringed;
Processing of de-identified personal data for research, statistics, or other lawful purposes.

7. Retention and destruction

7.1. Personal data is processed until the purpose of processing is achieved, or until the data subject withdraws consent, unless the laws of the Russian Federation provide otherwise.

7.2. Personal data is destroyed:

on a written request from the subject;
within 30 calendar days after the purpose of processing is achieved;
when processing must stop for another reason.

7.3. Methods of destruction:

electronic deletion from personal data systems and archives;
destruction of paper media by methods that prevent recovery.

8. Processing conditions and transfers

8.1. Personal data is processed by mixed means, using both automated and non-automated tools.

8.2. Personal data may be transferred to third parties only with the data subject’s written consent, except where federal law provides otherwise.

8.3. Cross-border transfer of personal data is not carried out, except to states that provide adequate protection of data subjects’ rights under the list maintained by Roskomnadzor.

8.4. Access to personal data is limited and is granted only to authorized employees of the Operator who have completed the relevant training.

8.5. Processing of personal data for marketing is carried out only with a separate consent from the subject.

9. Security measures

The Operator takes organizational, legal, and technical measures to keep personal data secure during processing, in order to prevent unauthorized access, loss, destruction, modification, blocking, copying, disclosure, and other unlawful actions.

9.1. Organizational measures:

A person responsible for organizing the processing of personal data has been appointed;
Internal rules governing the processing and protection of personal data have been approved;
Employee access levels are defined, and people responsible for information security are appointed;
Machine-readable media and documents that contain personal data are recorded;
Employees who process personal data receive regular instruction and training;
Internal control and audit of processing and of the security measures in place are organized.

9.2. Legal measures:

Non-disclosure agreements are in place with employees and counterparties who have access to personal data;
Processing and transfer follow the laws of the Russian Federation;
Procedures are defined for responding to personal data incidents and for notifying subjects.

9.3. Technical measures:

Information systems are protected by antivirus software, firewalls, and intrusion detection tools;
Certified information-security tools that meet the requirements of FSTEC and the FSB of Russia are used;
All actions with personal data in information systems are logged;
Regular backups are made, and data can be restored;
Physical access to rooms where personal data is processed is limited (alarms, security, access control);
The effectiveness of the measures is assessed before a personal data system goes live and while it is in operation.

9.4. Review and updates:

Security threats are monitored continuously, and protections are updated when processing conditions change;
Findings from internal reviews are followed by action to correct the issues found.

10. Rights of the data subject

A data subject has the right to:

receive information about their personal data and how it is processed;
require that their personal data be corrected, blocked, or deleted where there are grounds to do so;
withdraw consent to processing at any time;
file a complaint with Roskomnadzor and/or the courts;
require that processing for marketing and promotion of goods or services be stopped.

11. Final provisions

11.1. This Policy remains in force until it is replaced by a new version.

11.2. Changes take effect when they are approved and published on the Operator’s official website.

11.3. Operator contact details:

Address: 125480, Moscow, Geroyev Panfilovtsev St., building 22, block 4, apt. 1054

Email: legal@sintaxis.ru

Phone: +7 (499) 112-01-21